[Webkit-unassigned] [Bug 199445] New: [GTK] fast/forms/interactive-validation-remove-node-in-handler.html is crashing in an assertion

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Wed Jul 3 07:39:55 PDT 2019 

https://bugs.webkit.org/show_bug.cgi?id=199445

            Bug ID: 199445
           Summary: [GTK]
                    fast/forms/interactive-validation-remove-node-in-handl
                    er.html is crashing in an assertion
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebKitGTK
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: aboya at igalia.com
                CC: bugs-noreply at webkitgtk.org

fast/forms/interactive-validation-remove-node-in-handler.html

ASSERTION FAILED: ScriptDisallowedScope::InMainThread::isEventDispatchAllowedInSubtree(childToRemove)
../../Source/WebCore/dom/ContainerNode.cpp(133) : bool WebCore::ContainerNode::removeNodeWithScriptAssertion(WebCore::Node&, WebCore::ContainerNode::ChildChangeSource)
1   0x7fac927f71e1 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18(WTFCrash+0x9) [0x7fac927f71e1]
2   0x7fac927f71f7 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18(WTFIsDebuggerAttached+0) [0x7fac927f71f7]
3   0x7faca051d7d2 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(WebCore::ContainerNode::removeNodeWithScriptAssertion(WebCore::Node&, WebCore::ContainerNode::ChildChangeSource)+0xde) [0x7faca051d7d2]
4   0x7faca0516bf6 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(WebCore::ContainerNode::removeChild(WebCore::Node&)+0x104) [0x7faca0516bf6]
5   0x7faca09836f7 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(WebCore::ValidationMessage::deleteBubbleTree()+0xd3) [0x7faca09836f7]
6   0x7faca09820d9 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(WebCore::ValidationMessage::~ValidationMessage()+0x5b) [0x7faca09820d9]
7   0x7faca086d4b2 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(std::default_delete<WebCore::ValidationMessage>::operator()(WebCore::ValidationMessage*) const+0x22) [0x7faca086d4b2]
8   0x7faca086d7dd /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(std::unique_ptr<WebCore::ValidationMessage, std::default_delete<WebCore::ValidationMessage> >::reset(WebCore::ValidationMessage*)+0x55) [0x7faca086d7dd]
9   0x7faca086a473 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(std::unique_ptr<WebCore::ValidationMessage, std::default_delete<WebCore::ValidationMessage> >::operator=(decltype(nullptr))+0x21) [0x7faca086a473]
10  0x7faca085fc23 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(WebCore::HTMLFormControlElement::removedFromAncestor(WebCore::Node::RemovalType, WebCore::ContainerNode&)+0x5d) [0x7faca085fc23]
11  0x7faca08610e2 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(WebCore::HTMLFormControlElementWithState::removedFromAncestor(WebCore::Node::RemovalType, WebCore::ContainerNode&)+0x8a) [0x7faca08610e2]
12  0x7faca0894aa1 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(WebCore::HTMLInputElement::removedFromAncestor(WebCore::Node::RemovalType, WebCore::ContainerNode&)+0x5f) [0x7faca0894aa1]
13  0x7faca051917f /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0xc47517f) [0x7faca051917f]
14  0x7faca051923e /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0xc47523e) [0x7faca051923e]
15  0x7faca051923e /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0xc47523e) [0x7faca051923e]
16  0x7faca051923e /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0xc47523e) [0x7faca051923e]
17  0x7faca0519592 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(WebCore::notifyChildNodeRemoved(WebCore::ContainerNode&, WebCore::Node&)+0xb4) [0x7faca0519592]
18  0x7faca05197d1 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(WebCore::addChildNodesToDeletionQueue(WebCore::Node*&, WebCore::Node*&, WebCore::ContainerNode&)+0x219) [0x7faca05197d1]
19  0x7faca0519889 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(WebCore::removeDetachedChildrenInContainer(WebCore::ContainerNode&)+0x33) [0x7faca0519889]
20  0x7faca0514d3a /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(WebCore::ContainerNode::removeDetachedChildren()+0x6e) [0x7faca0514d3a]
21  0x7faca0555473 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(WebCore::Document::removedLastRef()+0x1cd) [0x7faca0555473]
22  0x7faca066e162 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(WebCore::Node::removedLastRef()+0x60) [0x7faca066e162]
23  0x7fac9e9254f8 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(WebCore::Node::deref()+0x12c) [0x7fac9e9254f8]
24  0x7faca0667f26 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(WebCore::Node::derefEventTarget()+0x18) [0x7faca0667f26]
25  0x7fac9eec52b9 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(WebCore::EventTarget::deref()+0x23) [0x7fac9eec52b9]
26  0x7fac9f366108 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(WTF::Ref<WebCore::EventTarget, WTF::DumbPtrTraits<WebCore::EventTarget> >::~Ref()+0x2c) [0x7fac9f366108]
27  0x7fac9f365494 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(WebCore::JSDOMWrapper<WebCore::EventTarget>::~JSDOMWrapper()+0x1c) [0x7fac9f365494]
28  0x7fac9f3654b0 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(WebCore::JSEventTarget::~JSEventTarget()+0x18) [0x7fac9f3654b0]
29  0x7fac9f3600c6 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(WebCore::JSEventTarget::destroy(JSC::JSCell*)+0x20) [0x7fac9f3600c6]
30  0x7fac92410ce5 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18(JSC::JSDestructibleObjectDestroyFunc::operator()(JSC::VM&, JSC::JSCell*) const+0x2d) [0x7fac92410ce5]
31  0x7fac9241aa51 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18(JSC::MarkedBlock::Handle::specializedSweep<false, (JSC::MarkedBlock::Handle::EmptyMode)0, (JSC::MarkedBlock::Handle::SweepMode)0, (JSC::MarkedBlock::Handle::SweepDestructionMode)0, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)0, (JSC::MarkedBlock::Handle::MarksMode)0, JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::JSDestructibleObjectDestroyFunc const&)::{lambda(void*)#1}::operator()(void*) const+0x49) [0x7fac9241aa51]
LEAK: 1 WebPageProxy

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20190703/cd4212a3/attachment-0001.html>

More information about the webkit-unassigned mailing list